CVE-2001-1088 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 19.7% (pctl 97)
Patch early
A public exploit exists.
Description
Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled, do not notify the user when the "Reply-To" address is different than the "From" address, which could allow an untrusted remote attacker to spoof legitimate addresses and intercept email from the client that is intended for another user.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 19.71% — more likely to be exploited than 97% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2001-06-05 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| microsoft | outlook |
| microsoft | outlook express |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Microsoft Outlook 97/98/2000/4/5 - Address Book Spoofing | 2001-06-05 |
References
- http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241
- http://www.securityfocus.com/archive/1/188752
- http://www.securityfocus.com/bid/2823
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6655
- http://support.microsoft.com/default.aspx?scid=kb%3BEN-US%3Bq234241
- http://www.securityfocus.com/archive/1/188752
- http://www.securityfocus.com/bid/2823
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6655
→ the Explorer · watch your stack · NVD